NetBSD Problem Report #43143

From www@NetBSD.org  Fri Apr  9 20:47:00 2010
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 97B6963C479
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  9 Apr 2010 20:47:00 +0000 (UTC)
Message-Id: <20100409204700.35C5563BA59@www.NetBSD.org>
Date: Fri,  9 Apr 2010 20:47:00 +0000 (UTC)
From: Christoph_Egger@gmx.de
Reply-To: Christoph_Egger@gmx.de
To: gnats-bugs@NetBSD.org
Subject: kernel crash when closing ssh session while a tip session is open
X-Send-Pr-Version: www-1.0

>Number:         43143
>Category:       kern
>Synopsis:       kernel crash when closing ssh session while a tip session is open
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Apr 09 20:50:00 +0000 2010
>Originator:     Christoph Egger
>Release:        amd64 -current
>Organization:
>Environment:
>Description:

When I plug my Samsung Galaxy mobile phone via USB,
I get this dmesg output:

umodem0 at uhub1 port 2 configuration 2 interface 0
umodem0: Qualcomm Incorporated Samsung Android USB Device, rev
2.00/1.00, addr 3, iclass 2/2
umodem0: data interface 1, has no CM over data, has break
umodem0: status change notification available
ucom0 at umodem0
umodem0: WARNING: power management not supported
umass0 at uhub1 port 2 configuration 2 interface 3
umass0: Qualcomm Incorporated Samsung Android USB Device, rev 2.00/1.00,
addr 3
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 2 luns per target
sd0 at scsibus0 target 0 lun 0: <Samsung, SAMSUNG Android, Mass> disk
removable
sd0(umass0:0:0:0): preposterous sector size: 0x0.  Defaulting to 512 bytes.
sd0: fabricating a geometry
sd0: 512, 0 cyl, 64 head, 32 sec, 512 bytes/sect x 1 sectors
sd0(umass0:0:0:0): preposterous sector size: 0x0.  Defaulting to 512 bytes.
sd0: fabricating a geometry

I can connect to ucom0 with tip and exit.

When I connect to ucom0 with tip in a ssh session and exit
the ssh session with ~. then the kernel crashes:

panic: kernel diagnostic assertion "ub != NULL" failed: file
"sys/dev/usb/ucom.c", line 1005
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8023b0e5 cs 8 rflags 246 cr2 7f7ffdb10920
cpl 8 rsp ffff80004ecbb7b0
Stopped in pid 709.1 (tip) at netbsd:breakpoint+0x5: leave

db{1}> bt
breakpoint+0x5
panic+0x2ba
kern_assert+0x2d
ucomstart+0x1a9
ttywait+0x5f
ttywflush+0xf
ttylclose+0x45
ucomclose+0x7e
cdev_close+0x49
spec_close+0x118
VOP_CLOSE+0x62
vn_close+0x4b
closef+0x6a
fd_free+0x1b4
exit1+0x121
sys_exit+0x4c
syscall+0xaa
db{1}>


>How-To-Repeat:

Connect to ucom0 with tip in a ssh session and exit the ssh session
with ~.

>Fix:

Home	PR Database Search